Measuring the Accessibility of Domain Name Encryption and Its Impact on Internet Filtering

Abstract

Most online communications rely on DNS to map domain names to their hosting IP address(es). Previous work has shown that DNS-based network interference is widespread due to the unencrypted and unauthenticated nature of the original DNS protocol. In addition to DNS, accessed domain names can also be monitored by on-path observers during the TLS handshake when the SNI extension is used. These lingering issues with exposed plaintext domain names have led to the development of a new generation of protocols that keep accessed domain names hidden. DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) hide the domain names of DNS queries, while Encrypted Server Name Indication (ESNI) encrypts the domain name in the SNI extension.

We present DNEye, a measurement system built on top of a network of distributed vantage points, which we used to study the accessibility of DoT/DoH and ESNI, and to investigate whether these protocols are tampered with by network providers (e.g., for censorship). Moreover, we evaluate the efficacy of these protocols in circumventing network interference when accessing content blocked by traditional DNS manipulation. We find evidence of blocking efforts against domain name encryption technologies in several countries, including China, Russia, and Saudi Arabia. At the same time, we discover that domain name encryption can help with unblocking more than 55% and 95% of censored domains in China and other countries where DNS-based filtering is heavily employed.

Appendices

A DoTH Resolvers

Table 4 indexes 71 DoTH resolvers publicly available at the time of our study.

B DNS Tampering Detection

To identify cases of DNS-based network interference, we employ the following well-established consistency heuristics in the literature [24, 42, 48, 51].

Multiple Responses with Different ASes. We receive multiple responses for a DNS query that belong to different ASes. Previous studies have identified cases where on-path filtering systems inject packets carrying false IP addresses that often are publicly routable [8, 29, 43].

NXDomain or Non-routable Address. We receive an NXDomain or non-routable IP in response to a DNS query from a vantage point while receiving a routable address from the majority of vantage points and our control node.

Different Responses from Control and Aggregate. When a vantage point receives a globally routable IP but different from the IP observed at the control node. We first check whether they belong to the same AS. If both IPs are under the same AS, this is due to the use of CDN and/or DNS-based load balancing but not censorship. If the IP observed by the vantage point belongs to an AS which is different from the response AS we observe at the control node and the majority of other vantage points, this behavior indicates DNS interference by a filtering system that aims to redirect the client to a different server (e.g., for displaying blockpages). However, there are also cases in which different ASes are managed by large CDN providers (e.g., Akamai). We look up organization information of those ASes to exclude cases where different response ASes belong to the same organization to avoid false positives.

Table 4. The list of DoTH resolvers that is used in our measurement.

C AS-Level DoTH Filtering

Table 5 shows the top five countries where most connections to DoTH resolvers were interfered with. The DoTH server names are indexed in Table 4.

Table 5. Top five countries where most AS-level DoTH filtering was detected. * indicate cases where both TCP and TLS handshakes were completed but we could not obtain the correct IP of our control domain being resolved.

D ESNI Prevalence

Over the course of our measurement period, we frequently query for ESNI TXT records of more than 350M domains from TLD zone files [2]. Only 3%–4.5% of domains respond to our ESNI TXT queries. And, only 48–51% of these TXT records have a valid ESNI key format defined in the Internet drafts [21, 23]. Analyzing the key lengths of all ESNI TXT records obtained, we find that the majority of them have 92 characters. These ESNI-supported domains are hosted by Cloudflare, which is the only Internet company supporting ESNI to the best of our knowledge. For domains whose ESNI TXT records that do not have a correct ESNI key format, we find that their authoritative nameservers are configured with a wildcard setup (i.e., *.example.com), thus responding to our ESNI TXT query for _esni.example.com despite not having an actual ESNI key. To that end, only around 1.5%–2.25% of domains on the Internet have ESNI supported.